WO2017028323A1

WO2017028323A1 - Radio frequency fingerprint-based cross-layer authentication method

Info

Publication number: WO2017028323A1
Application number: PCT/CN2015/087880
Authority: WO
Inventors: 文红; 张金玲; 廖润发; 唐杰; 潘绯
Original assignee: 电子科技大学
Priority date: 2015-08-19
Filing date: 2015-08-24
Publication date: 2017-02-23
Also published as: CN105162778A; CN105162778B; US20170251364A1; US10251058B2

Abstract

Disclosed is a radio frequency fingerprint-based cross-layer authentication method. The method comprises the following steps: S1, in a first timeslot, an authorized sender A sends a first data packet to an authorized receiver B and carries out upper-layer authentication on the first data packet; S2, extract a radio frequency fingerprint characteristic vector of the authorized sender A, and storing the radio frequency fingerprint characteristic vector in a memory of the authorized receiver B; S3, in a next timeslot, a sender X sends a second data packet to the authorized receiver B, and extracts a radio frequency fingerprint characteristic vector of the sender X; and S4, set a radio frequency fingerprint characteristic vector sample; and S5, determine a similarity degree between the radio frequency fingerprint characteristic vector of the sender X and the radio frequency fingerprint characteristic vector sample; if the similarity degree is greater than or equal to a set threshold, indicate that the radio frequency fingerprint authentication is successful, and store the radio frequency fingerprint characteristic vector of the sender X, and turn to step S3; and otherwise, indicate that the radio frequency fingerprint authentication fails, discard the second data packet and turn to step S1. The present method has the characteristics of low complexity, low time delay and high precision.

Description

Cross-layer authentication method based on radio frequency fingerprint

Technical field

The present invention relates to the field of information security technologies, and in particular, to a cross-layer authentication method based on radio frequency fingerprint.

Background technique

The openness of wireless communication networks makes it easy for an attacker to inject malicious data or tamper with the contents of a legitimate message during wireless transmission. Broadcast message authentication is an effective solution against most attacks that may occur, allowing a given receiver to determine the data that receives the desired source of information. The use of public key infrastructure-based data signature techniques (such as RSA or DSA) involves intensive computing in signature authentication, resulting in very severe resource consumption, which adds a significant burden to mobile devices with very limited resources. With the development of wireless communication, the security and privacy risks of mobile e-commerce have become the focus of attention. Mobile terminals, WiFi network cards and RFID tags are in urgent need of low complexity and low cost authentication. For such resource-constrained situations, a security scheme for a lightweight cipher machine given TESLA technology is proposed. Although TESLA is one of the best known solutions, it still requires synchronization between nodes and is vulnerable to denial of service attacks. The attacker blocks the legitimate sender by continuously sending time synchronization requests. The security of the lightweight cipher machine. The strength is compromised. Most wireless communication solutions now only authenticate the first frame when accessing the network, and do not authenticate subsequent packets. This can lead to many security issues, such as ID tracking, man-in-the-middle attacks, and malicious node attacks.

Recently, some researchers have turned to the use of physical layer information to enhance the security of wireless communications, and attempt to combine existing authentication with channel-based physical layer authentication schemes for lightweight and fast authentication. These studies make use of the spatial and temporal uniqueness of the channel response of the physical layer, so that the channel response between communication nodes can be recognized only by legitimate senders and receivers like fingerprints, and integrates the existing message authentication scheme and the physical layer authentication mechanism. However, the spatio-temporal uniqueness of the communication channel is in a high-speed congestion environment; and this method is only applicable when the time interval between two time slots is less than the coherence time and the moving speed is very low. When the interval between two time slots of the communication parties is greater than the channel coherence time, they need to perform upper layer authentication.

The uniqueness of the radio frequency (RF) fingerprint is another important resource for identifying the state of the transmitter. This uniqueness is related to the electrical component, the printed circuit board route, the internal path of the integrated circuit, and the filter output of the wireless transmitter displayed by the high-precision and high-bandwidth oscilloscope in the RF, and the difference is between the transient signals. Can be reflected. The RF fingerprints of devices from different manufacturers vary widely. According to reports, even the radio frequency fingerprints on the same series of wireless network cards are different; thus the radio frequency fingerprints are very different and can be used to identify wireless transmitters.

Summary of the invention

The object of the present invention is to overcome the deficiencies of the prior art and provide a cross-layer authentication method based on radio frequency fingerprint, which has the characteristics of low complexity, small delay and high precision, and is very suitable for a resource-limited authentication environment.

The object of the present invention is achieved by the following technical solutions: a cross-layer authentication method based on radio frequency fingerprint, including the following step:

S1. In the first time slot, the legal sender A sends the first data packet to the legal receiver B, and performs upper layer authentication on the first data packet.

If the upper layer authentication succeeds, the trust connection between the legal sender A and the legal receiver B is established, and the process proceeds to step S2;

If the upper layer authentication fails, step S1 is repeated;

S2. The legal receiver B extracts the radio frequency fingerprint feature vector of the legal sender A, and stores the radio frequency fingerprint feature vector in the memory of the legal receiver B;

S3. In the next time slot, the sender X sends the second data packet to the legal receiver B, and the legal receiver B extracts the radio frequency fingerprint feature vector of the sender X.

S4. setting a radio frequency fingerprint feature vector sample;

S5. The legal receiver B performs radio frequency fingerprint authentication on the radio frequency fingerprint feature vector of the sender X in step S3 according to the radio frequency fingerprint feature vector, that is, determines the similarity between the radio frequency fingerprint feature vector of the sender X and the radio frequency fingerprint feature vector sample;

If the similarity is greater than or equal to the set threshold, the radio frequency fingerprint authentication is successful, the sender X is the legal sender A, and the radio frequency fingerprint feature vector of the sender X is stored in the memory of the legal receiver B, and the jump step S3;

If the similarity is less than the set threshold, the radio frequency fingerprint authentication fails, the sender X is the attacker E, and the legal receiver B discards the second data packet, and the process proceeds to step S1.

The upper layer authentication uses digital signature authentication based on public key infrastructure or TESLA based authentication.

When the upper layer authentication uses digital signature authentication based on the public key infrastructure, step S1 includes the following substeps:

S11. In the first time slot, the legal sender A is assigned an anonymous public/private key pair <pubK _A , priK _A >, public/private key pair <pubK _A , priK _A > with a certain lifetime. For Cert _A , the virtual ID of the public/private key pair <pubK _A , priK _A > is PVID _A ;

The legal recipient B is assigned an anonymous public/private key pair <pubK _B , priK _B > with a certain lifetime, and the public/private key pair <pubK _B , priK _B > is Cert _B , public key / The virtual ID of the private key pair <pubK _B , priK _B > is PVID _B ;

S12. The legitimate sender A uses the private key priK _A to sign the hash message of the first data packet, and the first data packet is represented as

Then the first packet

Send to legal recipient B, ie:

S13. The legal recipient B receives the first data packet.

After that, the legitimate recipient B uses the public key pubK _A to the first data packet.

Signature verification:

Where ||-collocated operator, T ₁ - current timestamp;

S14. If the signature verification is successful, the legal recipient B considers the first data packet.

The sender is the legal sender A, establishing a trust connection between the legitimate sender A and the legitimate receiver B;

S15. If the signature verification fails, the legal receiver B discards the first data packet.

Go to step S12.

The steps of the legal receiver B extracting the radio frequency fingerprint feature vector of the legal sender A and the legal receiver B extracting the radio frequency fingerprint feature vector of the sender X include the following steps:

S01. The legal receiver B receives the radio frequency signal;

S02. The legal receiver B uses the Hilbert transform to parse the received radio frequency signal, then calculates the instantaneous phase of the radio frequency signal, and detects the transient signal by the phase detection method;

S03. The legal receiver B obtains a smooth instantaneous envelope curve by using a wavelet analysis transform method;

S04. Using the fitting curve to process the instantaneous envelope curve to obtain the fitting coefficient, that is, extracting the RF fingerprint feature vector.

The identifiers used in the step S5 for performing radio frequency fingerprint authentication are an SVM recognizer and a BP neural network recognizer.

The verification algorithm for performing radio frequency fingerprint authentication in the step S5 is a likelihood ratio test method or a sequential probability ratio test method.

The step of setting a threshold is also included before the step S5.

The radio frequency fingerprint feature sample in the step S4 includes one or more of the radio frequency fingerprint feature vectors stored in the memory of the legal recipient B.

The beneficial effects of the invention are:

(1) The present invention uses the public key infrastructure-based digital signature authentication or the TESLA-based authentication for the first data packet to establish an upper-layer identity authentication only when a trusted connection is established between the legal sender A and the legitimate recipient B. The authentication of the data packet is realized by radio frequency fingerprint authentication, and has the characteristics of low computational complexity and small delay;

(2) Since the radio frequency fingerprint feature vector does not change with time, the time interval between the two time slots may be several hours or even several days in the case that the radio frequency fingerprint authentication does not fail and the communication is always connected;

(3) In the whole communication process, since the difference of the radio frequency fingerprint feature vector can be reflected between the transient signals, the attacker E cannot obtain the radio frequency fingerprint feature of the legal sender A extracted by the legal receiver B, and thus cannot be the legal sender. The data packets sent by A are tampering, forwarding or forging to ensure communication security.

DRAWINGS

1 is a flowchart of a cross-layer authentication method based on radio frequency fingerprint according to the present invention;

2 is a flow chart of extracting a radio frequency fingerprint feature vector in the present invention;

Figure 3 is an embodiment of the present invention.

detailed description

The technical solution of the present invention will be described in further detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following.

As shown in FIG. 1, the cross-layer authentication method based on radio frequency fingerprint includes the following steps:

If the upper layer authentication fails, step S1 is repeated.

The identity authentication of the first data packet uses digital signature authentication based on public key infrastructure or TESLA based authentication.

When the identity authentication of the first data packet is performed by digital signature authentication based on the public key infrastructure, step S1 includes the following sub-steps:

The legal recipient B is assigned an anonymous public/private key pair <pubK _B , priK _B > with a certain lifetime, and the public/private key pair <pubK _B , priK _B > is Cert _B , public key / The virtual ID of the private key pair <pubK _B , priK _B > is PVID _B ; the public key/private key pair <pubK _A , priK _A > and the public/private key pair <pubK _B , priK _B > have a lifetime For a few minutes.

Then the first packet

Send to legal recipient B, ie:

S13. The legal recipient B receives the first data packet.

Signature verification:

Where ||-collocated operator, T ₁ - current timestamp.

The sender is the legitimate sender A, establishing a trusted connection between the legitimate sender A and the legitimate receiver B.

Go to step S12.

S2. The legal receiver B extracts the radio frequency fingerprint feature vector of the legal sender A, and stores the radio frequency fingerprint feature vector in the memory of the legal receiver B.

As shown in FIG. 2, the steps of the legal receiver B extracting the radio frequency fingerprint feature vector of the legal sender A and the legal receiver B extracting the radio frequency fingerprint feature vector of the sender X include the following steps:

S01. The legal receiver B receives the radio frequency signal;

S4. Set the RF fingerprint feature vector sample. The radio frequency fingerprint feature sample in the step S4 includes one or more of the radio frequency fingerprint feature vectors stored in the memory of the legal receiver B, that is, the legal receiver B determines the radio frequency fingerprint feature vector and the radio frequency of the sender X. When the similarity of the radio frequency fingerprint feature vector included in the fingerprint feature vector sample, the radio frequency fingerprint feature vector sample includes the kS-1th to k-1th radio frequency fingerprint feature vectors stored by the legal receiver B, wherein the value of S is verified The algorithm determines.

S5. The legal receiver B performs radio frequency fingerprint authentication on the radio frequency fingerprint feature vector of the sender X in step S3 according to the radio frequency fingerprint feature vector, that is, determines the radio frequency fingerprint feature vector of the sender X and the radio frequency fingerprint feature included in the radio frequency fingerprint feature vector sample. Similarity of vectors;

The identifiers used in the step S5 for performing radio frequency fingerprint authentication are an SVM recognizer and a BP neural network recognizer. The legal receiver B uses the SVM identifier and the BP neural network identifier to identify the radio frequency fingerprint feature vector according to the radio frequency fingerprint feature vector sample, thereby performing radio frequency fingerprint verification on the received data packet.

The verification algorithm for performing radio frequency fingerprint authentication in the step S5 is a likelihood ratio test method or a sequential probability ratio test method. The verification algorithm determines the RF fingerprint feature vector contained in the RF fingerprint feature vector sample.

The step of setting a threshold is also included before the step S5.

The invention only uses the public key infrastructure-based digital signature authentication or the TESLA-based authentication for the first data packet to establish the upper-layer identity authentication when the trusted connection is established between the legal sender A and the legal receiver B; in the subsequent time slot As long as the authentication fails in the RF fingerprint authentication and the communication between the legitimate sender A and the legitimate receiver B is in a connected state, the legal receiver B only needs to perform radio frequency fingerprint authentication on the received data packet, which is complicated in calculation. Low degree and low delay.

Since the characteristics of the radio frequency fingerprint do not change with time, the time interval between the two time slots may be several hours or even several days when the radio frequency fingerprint authentication fails and the communication is always connected; when the radio frequency fingerprint authentication fails or the communication terminal After the connection needs to be re-established, the upper layer authentication of the data packet is required again. During the entire communication process, the difference in the characteristics of the radio frequency fingerprint can be reflected in the transient signal. The attacker E cannot obtain the radio frequency fingerprint feature of the legal sender A extracted by the legal receiver B, and thus cannot send the data to the legal sender A. The package is tampering, forwarding or forging to ensure communication security.

As shown in FIG. 3, in the first time slot, the legitimate sender A sends the first data packet to the legal receiver B, and the legal receiver B uses the digital signature authentication based on the public key infrastructure to authenticate the first data packet: If the authentication succeeds, the RF fingerprint feature vector RF _{AB,1 of the} legal sender A is extracted and saved; if the authentication fails, the current data packet is discarded, the legal sender A resends the first data packet, and the legal recipient B adopts the public key. The digital signature authentication of the infrastructure authenticates the first data packet.

In the second time slot, the sender X sends the second data packet to the legal receiver B.

The legal receiver B extracts the RF fingerprint feature vector RF _{AB,2 of the} sender X; the legal receiver B uses the likelihood ratio test or the sequential probability ratio test to evaluate the radio frequency fingerprint according to the radio frequency fingerprint feature vector RF _AB,1 Vector RF _{AB, 2} performs RF fingerprint authentication; if the RF fingerprint authentication is successful, the RF fingerprint feature vector RF _{AB, 2} is saved _, and the sender X sends the next data packet to the legal receiver B; if the RF fingerprint authentication fails, the current data is discarded. The data packet, the legitimate sender A resends the first data packet, and the legitimate recipient B authenticates the first data packet by using the digital signature authentication based on the public key infrastructure.

In the Kth time slot, the sender X sends the Kth packet to the legal receiver B.

The legal receiver B extracts the RF fingerprint feature vector RF _{AB,k of the} sender X _, and the legal receiver B uses the likelihood ratio test according to the radio frequency fingerprint feature vectors RF _{AB, k-1} , . . . , RF _{AB, kS-1} or The sequential probability ratio test method performs RF fingerprint authentication on the RF fingerprint feature vector RF _AB,k , wherein the value of S is determined by the selected algorithm; if the RF fingerprint authentication is successful, the RF fingerprint feature vector RF _AB,k is saved _, and the sender X sends the next data packet to the legal receiver B; if the radio frequency fingerprint authentication fails, the current data packet is discarded, the legitimate sender A resends the first data packet, and the legal recipient B uses the digital signature authentication based on the public key infrastructure. The first packet is authenticated.

Claims

A cross-layer authentication method based on radio frequency fingerprinting, comprising: the following steps:

S1. In the first time slot, the legal sender A sends the first data packet to the legal receiver B, and performs upper layer authentication on the first data packet.

If the upper layer authentication succeeds, the trust connection between the legal sender A and the legal receiver B is established, and the process proceeds to step S2;

If the upper layer authentication fails, step S1 is repeated;

S2. The legal receiver B extracts the radio frequency fingerprint feature vector of the legal sender A, and stores the radio frequency fingerprint feature vector in the memory of the legal receiver B;

S3. In the next time slot, the sender X sends the second data packet to the legal receiver B, and the legal receiver B extracts the radio frequency fingerprint feature vector of the sender X.

S4. setting a radio frequency fingerprint feature vector sample;

S5. The legal receiver B performs radio frequency fingerprint authentication on the radio frequency fingerprint feature vector of the sender X in step S3 according to the radio frequency fingerprint feature vector, that is, determines the similarity between the radio frequency fingerprint feature vector of the sender X and the radio frequency fingerprint feature vector sample;

If the similarity is greater than or equal to the set threshold, the radio frequency fingerprint authentication is successful, the sender X is the legal sender A, and the radio frequency fingerprint feature vector of the sender X is stored in the memory of the legal receiver B, and the jump step S3;

If the similarity is less than the set threshold, the radio frequency fingerprint authentication fails, the sender X is the attacker E, and the legal receiver B discards the second data packet, and the process proceeds to step S1.
The cross-layer authentication method based on radio frequency fingerprint according to claim 1, wherein the upper layer authentication adopts digital signature authentication based on public key infrastructure or TESLA based authentication.
The cross-layer authentication method based on radio frequency fingerprint according to claim 2, wherein when the upper layer authentication uses digital signature authentication based on a public key infrastructure, step S1 includes the following substeps:

S11. In the first time slot, the legal sender A is assigned an anonymous public/private key pair <pubK A , priK A >, public/private key pair <pubK A , priK A > with a certain lifetime. For Cert A , the virtual ID of the public/private key pair <pubK A , priK A > is PVID A ;

The legal recipient B is assigned an anonymous public/private key pair <pubK B , priK B > with a certain lifetime, and the public/private key pair <pubK B , priK B > is Cert B , public key / The virtual ID of the private key pair <pubK B , priK B > is PVID B ;

S12. The legitimate sender A uses the private key priK A to sign the hash message of the first data packet, and the first data packet is represented as
Then the first packet
Send to legal recipient B, ie:

S13. The legal recipient B receives the first data packet.
After that, the legitimate recipient B uses the public key pubK A to the first data packet.
Signature verification:

Where ||-collocated operator, T 1 - current timestamp;

S14. If the signature verification is successful, the legal recipient B considers the first data packet.
The sender is the legal sender A, establishing a trust connection between the legitimate sender A and the legitimate receiver B;

S15. If the signature verification fails, the legal receiver B discards the first data packet.
Go to step S12.
The cross-layer authentication method based on radio frequency fingerprint according to claim 1, wherein the legal receiver B extracts the radio frequency fingerprint feature vector of the legal sender A and the legal receiver B extracts the radio frequency fingerprint feature vector of the sender X. The steps include the following steps:

S01. The legal receiver B receives the radio frequency signal;

S02. The legal receiver B uses the Hilbert transform to parse the received radio frequency signal, then calculates the instantaneous phase of the radio frequency signal, and detects the transient signal by the phase detection method;

S03. The legal receiver B obtains a smooth instantaneous envelope curve by using a wavelet analysis transform method;

S04. Using the fitting curve to process the instantaneous envelope curve to obtain the fitting coefficient, that is, extracting the RF fingerprint feature vector.
The cross-layer authentication method based on radio frequency fingerprint according to claim 1, wherein the identifier used in the step of performing RF fingerprint authentication in step S5 is an SVM recognizer and a BP neural network recognizer.
The cross-layer authentication method based on radio frequency fingerprint according to claim 1, wherein the verification algorithm for performing radio frequency fingerprint authentication in step S5 is a likelihood ratio test method or a sequential probability ratio test method.
The cross-layer authentication method based on radio frequency fingerprint according to claim 1, wherein the step S5 further comprises the step of setting a threshold.
The cross-layer authentication method based on radio frequency fingerprint according to claim 1, wherein the radio frequency fingerprint feature sample in step S4 comprises one or more of radio frequency fingerprint feature vectors stored in a memory of a legal recipient B. .